A network-based content management service can store an enormous quantity of data (content items) for many thousands of users. Typically, a content management service allows users to upload, store and retrieve content items to and from the network servers managed by the content management service. Additionally, the content management service can provide functionality that allows one user to share content items hosted by the content management service with other users of the service. This content sharing feature can allow a malicious user to share or distribute malicious content to other users of the content management service.
To combat the spread of malicious content, a content management service could run a virus scan on each content item uploaded to, stored to or shared from the storage servers of the service. However, with terabytes, petabytes and even exabytes of data stored, it is not practical for the content management service to run a virus scan on each content item stored at the content management service. Thus, a mechanism is needed by which the content management service can detect and prevent the spread of malware (e.g., viruses) while not being burdened with scanning every content item stored by the content management service.